Not sure but GrapheneOS has an “LTE only” mode, stock Android only has preferred Network afaik.
visiting only known websites is not a scaleable option, a browser needs to be secure. Kiwix is the browser that basically runs desktop Chromium on Android, so it has Addon support. But that is also soon manifest v3 restricted, and likely pretty insecure.
of course the user data partition is not checked, but every other important one. I have not tested what would happen when it is modified though.
I dont know what magisk did, but I think that is only about Google Play adding their “safety” scanning to the OS. Nothing regarding boot. But yes, likely there could, can or should be OS components scanning things too.
Googles stuff is pretty insecure, for example the latest SafetyNetFix simply disabled hardware cryptography, as they still support insecure phones.
For sure this is very complex and there are always vulnerabilities found in Android and GrapheneOS.